Rapid Scada Elevation of Privilege Vulnerability

Rapid Scada is a free and open source SCADA software. The software supports the creation of industrial automation, home automation, and energy accounting types of systems. A security vulnerability exists in Rapid Scada version 5.5.0, which stems from a weak access control restriction set by the...

CVE-2018-5313

A vulnerability allows local attackers to escalate privilege on Rapid Scada 5.5.0 because of weak C:\SCADA permissions. The specific flaw exists within the access control that is set and modified during the installation of the product. The product sets weak access control restrictions. An attacke...

Vulnerability of the Server:Replication component of the MySQL database management system, which allows a hacker to modify, add, or delete MySQL data, or cause service interruptions.

The vulnerability of the Server:Replication component of the MySQL database management system is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to remotely modify, add, or delete MySQL data, or cause service failures...

CVE-2015-7961

SafeNet Authentication Service Remote Web Workplace Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifying an executable module...

CVE-2015-7966

SafeNet Authentication Service Windows Logon Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifying an executable module, a different vulnerability than CVE-2015-7965...

CVE-2015-7963

SafeNet Authentication Service for AD FS Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifying an executable module...

CVE-2015-7964

SafeNet Authentication Service for NPS Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifying an executable module...

CVE-2015-7967

SafeNet Authentication Service for Citrix Web Interface Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifying an executable module...

CVE-2015-7965

SafeNet Authentication Service Windows Logon Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifying an executable module, a different vulnerability than CVE-2015-7966...

TP-Link TL-SG108E Denial of Service Vulnerability

The TP-Link TL-SG108E is a Gigabit Ethernet switch from China P&L TP-LINK. A denial of service vulnerability exists in the Device Logout function in the TP-Link TL-SG108E version 1.0.0 due to weak access control. A remote attacker can exploit the vulnerability to invoke the logout function and...

TP-Link TL-SG108E Authentication Vulnerability

The TP-Link TL-SG108E is a Gigabit Ethernet switch from China P&L TP-LINK. An authentication vulnerability exists in the TP-Link TL-SG108E version 1.0.0 due to a weak access control method used by the program. An attacker could exploit the vulnerability to access the device...

TP-Link TL-SG108E XSS / Weak Access Control Vulnerability

TP-Link TL-SG108E with firmware 1.0.0 Build 20160722 Rel.50167 suffers from cross site scripting and weak access control vulnerabilities. Overview ------------- Three vulnerabilities have been discovered in the TP-Link TL-SG108E, firmware 1.0.0 Build 20160722 Rel.50167: CVE-2017-17745 - Cross Sit...

TP-Link TL-SG108E XSS / Weak Access Control

Overview ------------- Three vulnerabilities have been discovered in the TP-Link TL-SG108E, firmware 1.0.0 Build 20160722 Rel.50167: CVE-2017-17745 - Cross Site Scripting XSS in systemnameset.cgi, sysName parameter CVE-2017-17746 - Weak access control for user authentication CVE-2017-17747 - Weak...

CVE-2014-8358

Huawei EC156, EC176, and EC177 USB Modem products with software before UTPS-V200R003B015D02SP07C1014 23.015.02.07.1014 and before V200R003B015D02SP08C1014 23.015.02.08.1014 use a weak ACL for the "Mobile Partner" directory, which allows remote attackers to gain SYSTEM privileges by compromising a...

The vulnerability in the web interface of the Cisco IOS XE operating system allows attackers to enhance their privileges and affect the confidentiality, integrity, and accessibility of data.

The vulnerability of the Cisco IOS XE operating system’s web interface is related to deficiencies in access control for new users—specifically, the access settings that are configured for users through the web interface. Exploiting this vulnerability allows a malicious actor to enhance their...

The vulnerability of the Android operating system’s GNSS component from the CAF repository allows a perpetrator to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the Android operating system’s GNSS component from the CAF repository is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality, integrity, and accessibility of protected information during...

The vulnerability of the JNDI component of the Oracle WebLogic Server application server allows a hacker to gain control over the application server.

The vulnerability of the JNDI component of the Oracle WebLogic Server application server is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker, operating remotely, to gain control over the Oracle WebLogic Server application server through HTTP requests...

Google Android Qualcomm Component Unauthorized Operation Vulnerability (CNVD-2017-26918)

Android is a Linux-based open-source operating system developed by Google and the Open Handheld Alliance OHA, and Qualcomm closed-source components are among the closed-source components developed by Qualcomm. A security vulnerability exists in the Qualcomm closed-source component in Android, whi...

The vulnerability of the plugin designed for accessing PodSecurityPolicy, a software tool for managing clusters of virtual machines in Kubernetes, allows a perpetrator to increase their privileges.

The vulnerability of the plugin designed for accessing PodSecurityPolicy, a software tool for managing clusters of virtual machines in Kubernetes, is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to enhance their privileges remotely, enabli...

CVE-2017-6340

Trend Micro InterScan Web Security Virtual Appliance IWSVA 6.5 before CP 1746 does not sanitize a rest/commonlog/report/template name field, which allows a 'Reports Only' user to inject malicious JavaScript while creating a new report. Additionally, IWSVA implements incorrect access control that...